verapli
Sign inJoin free
Menu

Guides · devtools · Verification-gated

App Store Connect API key

Get programmatic access to App Store Connect (builds, TestFlight, metadata, users, provisioning, reports). The Account Holder requests API access once; Apple reviews it; then Admins create team keys (or users create individual keys) whose private .p8 half is downloadable only once and signs 20-minute JWTs.

Researched · not yet run liveLast researched 25 October 2026 · Apple · provider site

Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Do this with verapliJSON for agents

Who owns what

API access is switched on per App Store Connect team (one per developer membership) by the Account Holder. Team keys belong to the team, carry a role (e.g. Admin, App Manager, Developer) and see all apps; individual keys inherit one user's apps and permissions.

  • Apple Developer Program membership / App Store Connect team developer owned by the company (or individual developer)
  • Account Holder personal · under Apple Developer Program membership / App Store Connect teamOnly role that can request API access.
  • Admin user personaloptional · under Apple Developer Program membership / App Store Connect teamCan generate and revoke team keys after access is approved.

Team keys cannot be limited to particular apps; pick the narrowest role that works.

Individual keys cannot use Provisioning endpoints.

Have ready

  • The Account Holder available to sign in and accept the API terms. · Only the Account Holder can request access. [1]Needed for: Request API access (Account Holder, once per team)
  • A secret store ready for the .p8 file and the decision on which role the key needs. · The key downloads once; its role cannot be changed later. [1]Needed for: Generate a team API key, Download the private key once

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Sign in to App Store Connect

    Sign in as the Account Holder (first time) or an Admin.

    • Guided by hand
    • Human step: You enter a 2-step code

    Where: https://appstoreconnect.apple.com/

  2. Request API access (Account Holder, once per team)

    In Users and Access > Integrations, click Request Access, tick the box to agree to the terms and submit.

    • Guided by hand
    • Human step: You accept the terms
    • After: Sign in to App Store Connect

    Where: https://appstoreconnect.apple.com/

  3. Wait for Apple to approve access

    Apple reviews and approves requests case by case. Team Keys appear once approved.

    • Guided by hand
    • Human step: The provider reviews it
    • After: Request API access (Account Holder, once per team)
    The provider says
    Reviewed and approved on a case-by-case basis; no timeline published. [1]
    If something goes wrong (2)
    • No Team Keys tab or Generate API Key button.: Access is not yet approved, or you are not an Admin or Account Holder. Ask the Account Holder to check the request. [1]
    • The Request Access button is greyed out.: Only the Account Holder can request access; sign in as the Account Holder. Users reported the button greyed out even for Account Holders in 2021 with no Apple fix posted - contact Apple Developer Support rather than editing the page. [4]

  4. Generate a team API key

    Users and Access > Integrations > App Store Connect API > Team Keys > Generate API Key (+). Name it and choose the role. Name and role cannot be edited later; revoke and recreate to change them.

    • Guided by hand
    • Human step: You press submit
    • After: Wait for Apple to approve access

    Where: https://appstoreconnect.apple.com/

  5. Download the private key once

    Click Download API Key next to the new key and store the AuthKey_<KEY_ID>.p8 file in your secret store. The link disappears after one download.

    • Guided by hand
    • After: Generate a team API key

    verapli captures APP_STORE_CONNECT_API_PRIVATE_KEY here by plain code: encrypted in your browser, never shown to AI.

    If something goes wrong (1)
    • The download link is gone and the file is lost.: Apple keeps no copy. Revoke the key and generate a new one (revocation cannot be undone, so update CI first). [2]

  6. Copy the Issuer ID and Key ID

    The Issuer ID is shown near the top of the Integrations page; the Key ID is listed under Active keys.

    • Guided by hand
    • After: Generate a team API key

    Where: https://appstoreconnect.apple.com/

  7. Or generate an individual keyoptional

    From your user profile in App Store Connect, generate an Individual API Key (one active key per user); it carries your own permissions.

    • Guided by hand
    • Human step: You press submit
    • After: Wait for Apple to approve access
    If something goes wrong (1)
    • No Generate API Key button on your profile.: An Admin must grant you the Generate Individual API Keys permission. [2]

  8. Sign request tokens

    Sign an ES256 JWT with kid = Key ID and payload iss = Issuer ID, iat, exp (no more than 20 minutes ahead), aud = appstoreconnect-v1, optionally scope to limit requests. Send as a Bearer token.

    • Guided by hand
    • After: Download the private key once, Copy the Issuer ID and Key ID
    If something goes wrong (2)
    • Requests are rejected as unauthorised.: Check exp is within 20 minutes, kid matches the key that signed the token, iss is the Issuer ID (team keys), aud is appstoreconnect-v1 and your clock is correct. [to verify] exact error codes. [3]
    • Provisioning endpoints refuse an individual key.: Individual keys cannot use Provisioning endpoints; use a team key. [2]

Terms and gotchas

Plain-English summary, not legal advice. Each card links its source.

Can get you bannedThe rules say

Admin keys are powerful

Keys with the Admin role can do things like create and delete users, and team keys reach every app. Use the narrowest role and never put keys in repositories or client-side code. [2]

Can get you bannedThe rules say

Do not share access outside your team

The licence agreement forbids sharing, selling or otherwise providing access to your developer account or its services to anyone who is not an Authorized Developer on your team. The Account Holder also accepts separate API terms when requesting access; read them for limits on third-party use. [to verify] wording of those terms. [5]

Can cost moneyThe rules say

Revocation is permanent

A revoked API key cannot be reinstated; revoked keys from the last 30 days are listed for reference only. [1]

What you end up with

Env varSecretFormatWhat it is
APP_STORE_CONNECT_ISSUER_IDnot secretxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxIssuer ID for team keys (UUID).
APP_STORE_CONNECT_KEY_IDnot secretABC123DEFGKey ID of the API key (JWT kid).
APP_STORE_CONNECT_API_PRIVATE_KEYsecretcontents of AuthKey_<KEY_ID>.p8The .p8 private key that signs API tokens. Secret; Apple keeps no copy.

Renewals

  • API request token (JWT) - regenerate before it expires (max 20 minutes ahead for most resources): every 20 minutes [3]

Pricing

  • No separate charge stated; requires an Apple Developer Program membership.

Source [1]

For agents

The same entry as JSON: /api/v1/entries/apple/app-store-connect-api · requirements /api/v1/requirements/apple/app-store-connect-api · terms /api/v1/terms/apple/app-store-connect-api.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for App Store Connect API key, and how long will it take?"
  → tools/call requirements { "provider_id": "apple/app-store-connect-api" }

Sources

  1. App Store Connect API - Get started - App Store Connect Help Account Holder must request access (Users and Access > Integrations > Request Access, agree to terms, submit); requests reviewed and approved case by case; team keys need Account Holder or Admin; individual keys need one of several roles, one active key per user; key name and access level cannot be edited; revoked keys cannot be reinstated; revoked keys from the last 30 days listed; Admin can remove the Generate Individual API Keys permission; keys cannot be used for other Apple services. · accessed 25 October 2026 · official
  2. Creating API Keys for App Store Connect API Team vs individual keys (individual keys cannot use Provisioning endpoints); to generate team keys you must have an Admin account; Admin-role keys can create and delete users; team keys access all apps; private key downloadable a single time and Apple keeps no copy; do not store keys in repositories or client code; revoke if compromised. · accessed 25 October 2026 · official
  3. Generating Tokens for API Requests ES256 JWT; kid = key ID; iss = issuer ID (team keys) or sub (individual keys); aud appstoreconnect-v1; tokens expiring more than 20 minutes ahead are invalid except for listed resources; optional scope claim; where to find issuer ID and key IDs. · accessed 25 October 2026 · official
  4. AppStore Connect API access request (Apple Developer Forums) Apple engineer reply (Nov 2018) that only the team agent / Account Holder can sign the agreement to request API access; May 2021 user reports of a greyed-out Request Access button with no Apple response. · accessed 25 October 2026 · community
  5. Apple Developer Program License Agreement Must not share, sell or provide access to your developer account or its services to anyone outside your team; you are responsible for safeguarding keys and tokens. · accessed 25 October 2026 · official

Provider rules change. This page is generated from verapli registry version 2026.1025.387; spotted something out of date? Tell us. Apple is not affiliated with verapli.